SOCIAL-259: Allow callback URL to be explicitly configured instead of relying on calculation from current request. Also make callbackUrl() protected to allow for overriding when neither calculation nor explicit specification are sufficient.